Good Memory is a rogue disk defragmenter, computer optimization and system protection program that reports false system threats, critical errors and performance issues. It's classified as a rogue application for several reasons. First of all, it detects the same errors and issues (11) on different computers. Some of the fake problems you may see:
- Read time of hard drive clusters less than 500 ms
- 32% of HDD space is unreadable
- Bad sectors on hard drive or damaged file allocation table
- Drive C initializing error
- Hard drive doesn't respond to system commands
- Data Safety Problem. System integrity is at risk.
- Registry Error - Critical Error
Good Memory has to be manually installed most of the time but it can come bundled with other malware. If you got hit with a Trojan virus then there is also a chance that you will end up with this fake application on your computer. Scammers distribute this bogus software via e-mails, malicious or hacked web pages, social networks, peer-to-peer networks, etc. Good Memory won't show up in add/remove programs list. Uninstall option that doesn't work either. You will have to remove Good Memory manually or with anti-malware software. We prefer second option because there can be more malware installed on your computer that are not included in the malware removal guide outlined below. When Good Memory is running, it may hide and desktop icons, task bar and change desktop background image/color. The rogue application may display even more fake security and system alerts saying that you can lose your files or that your computer may crash.
Critical Error
Damaged hard drive clusters detected. Private data is at risk
Low Disk Space
You are running very low disk space on Local Disk (C:).
Critical Error
A critical error has occurred while indexing data stored on hard drive. System restart required.
Good Memory is from the same family as Fast Disk and My Disk scareware.
Without a doubt, Good Memory is a scam. It doesn't do anything and asks money for fake malware/error removal. The problem is that Good Memory looks quite legitimate. Inexperienced Internet users may easily fall victim to this rogue program. If you have already purchased it, please contact your credit card company and dispute the charges. Be advised, that scammers may steal more money from your bank account if you gave them your credit card details. If you somehow ended up this bogus application on your computer, please follow the removal instructions below to remove Good Memory and related malware for free. Please inform your friends and associates about this threat. If you need additional help removing Good Memory, please leave a comment. Good luck and be sage online!
Good Memory removal instructions:
1. Download Process Explorer. (click the link and wait for few seconds, download will begin automatically)
2. End Good Memory processes, e.g. 2Hdgr52HdfrGH.exe or 2MfCCjX5Pv1fkr.exe.
3. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
4. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Good Memory removal instructions (in Safe Mode with Networking):
1. Reboot your computer is "Safe Mode with Networking". As the computer is booting tap the "F8 key" continuously which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press Enter key. Read more detailed instructions here: http://www.computerhope.com/issues/chsafe.htm
NOTE: Login as the same user you were previously logged in with in the normal Windows mode.
2. Download free anti-malware software from the list below and run a full system scan.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator. Launch the program and follow the prompts. Don't forget to update the installed program before scanning.
3. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
Good Memory associated files and registry values:
Files:
Windows XP:
- %AllUsersProfile%\Application Data\[SET OF RANDOM CHARACTERS]
- %AllUsersProfile%\Application Data\~[SET OF RANDOM CHARACTERS]
- %UsersProfile%\Local Settings\Application Data\[SET OF RANDOM CHARACTERS].DAT
- %AllUsersProfile%\Application Data\[SET OF RANDOM CHARACTERS].dll
- %AllUsersProfile%\Application Data\[SET OF RANDOM CHARACTERS].exe
- %UsersProfile%\Desktop\Good Memory.lnk
- %UsersProfile%\Start Menu\Programs\Good Memory\
- %UsersProfile%\Start Menu\Programs\Good Memory\Good Memory.lnk
- %UsersProfile%\Start Menu\Programs\Good Memory\Uninstall Good Memory.lnk
%UserProfile% refers to: C:\Documents and Settings\[User Name]
Windows Vista/7:
- %AllUsersProfile%\[SET OF RANDOM CHARACTERS]
- %AllUsersProfile%\~[SET OF RANDOM CHARACTERS]
- %AllUsersProfile%\[SET OF RANDOM CHARACTERS].dll
- %AllUsersProfile%\[SET OF RANDOM CHARACTERS].exe
- %UsersProfile%\Desktop\Good Memory.lnk
- %UsersProfile%\Start Menu\Programs\Good Memory\
- %UsersProfile%\Start Menu\Programs\Good Memory\Good Memory.lnk
- %UsersProfile%\Start Menu\Programs\Good Memory\Uninstall Good Memory.lnk
%UserProfile% refers to: C:\Users\[User Name]
Registry values:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS]"
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[SET OF RANDOM CHARACTERS].exe"
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes"='.zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;.scr;'
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = "no"
0 comments:
Post a Comment